Senderra RX Partners, LLC v. Loftin

SENDERRA RX PARTNERS, LLC, a Texas limited liability company, Plaintiff, v. DENAY R. LOFTIN and ELIZABETH R. NAYLOR, Defendants.

Case No. 15-13761

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF MICHIGAN SOUTHERN DIVISION

December 8, 2016

HON. AVERN COHN

DECISION AND ORDER GRANTING IN PART DEFENDANTS' MOTION FOR JUDGMENT ON THE PLEADINGS (Doc. 61) AND DISMISSING CASE

I. Introduction

This is an employment dispute. Plaintiff Senderra RX Partners, LLC (Senderra) is suing two former employees Denay R. Loftin (Loftin) and Elizabeth Naylor (Naylor), collectively "defendants" where appropriate.¹ The complaint essentially boils down to the allegation that defendants took confidential business information and protected patient health information by diverting all of their work emails to third-party email accounts. Senderra says this conduct violates several state and federal laws. The complaint asserts nine (9) claims:

Count I - violation of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, et seqCount II - violation of the Stored Communications Act (SCA), 18 U.S.C. § 2707

Count III - violation of the Electronic Communications Privacy Act (ECPA), in violation of 18 U.S.C. § 2510

Count IV - violation of Michigan's Uniform Trade Secrets Act, M.C.L. § 445.1901, et seq.

Count V - breach of fiduciary duty/duty of loyalty

Count VI - common law and statutory, M.C.L. 600.2919(A) conversion

Count VII - tortious interference with buisness relationships and expectancies

Count VIII - civil conspiracy

Count IX - negligence

Before the Court is defendants' motion for judgment on the pleadings, contending that all of the claims should be dismissed.² For the reasons that follow, the motion will be granted in part and denied in part. Senderra's federal claims under Counts I, II, and III will be dismissed for failure to state plausible claims for relief. The remaining counts will be dismissed without prejudice because the Court declines to exercise supplemental jurisdiction over them.

II. Background

Following are the relevant facts alleged in the complaint.

Senderra is a Texas limited liability company based in Richardson, Texas. It has offices and operations in Flint, Michigan and is authorized to do business in Michigan. Senderra is a specialty pharmacy serving patients with ailments such as rheumatoidarthritis, psoriasis, osteoporosis, and multiple sclerosis. Senderra's staff assists patients with all aspects of their specialty medications, and coordinates with physicians, insurance providers, and other resources to provide patients with care.

Loftin is a resident of Waterford, Michigan and is a licensed practical nurse ("LPN"), licensed by the State of Michigan. Loftin was employed with Senderra in Flint, Michigan from on or about April 22, 2014, until January 15, 2015.

Naylor is also a resident of Waterford, Michigan and Loftin's sister. She began her employment with Senderra in Flint on or about May 19, 2014, as a receptionist, later moving to the position of Prior Authorization Specialist. She was employed with Senderra from about May 19, 2014, to October 2, 2015.

As an LPN Nurse Consultant and a Prior Authorization Specialist, Loftin and Naylor, respectively, beginning with their training and ongoing throughout their employment, were exposed regularly, in the course of their duties, to proprietary and confidential information, processes, and procedures of Senderra. As part of this exposure and training, Loftin and Naylor also received protected health information, including, but not limited to, medical records and other documents or information that reflect patient names, home addresses, dates of birth, medical diagnoses, prescriptions from doctors, refill orders, specific brands or types of prescription medication, including amounts of same, physician recommendations, and the identities of physicians with whom Senderra has established relationships. They also received training and became familiar with Senderra's highly confidential processes and procedures related to workflow. Senderra also has formal policies governing the protection of confidential and protected patient health information.

During the course of her employment, Loftin set up an auto-forwarding command, rule or feature on her Senderra e-mail account, which directed all e-mails sent to her Senderra e-mail account to be immediately and contemporaneously forwarded to one or more personal e-mail addresses she owned and/or to which she had access. Loftin says this was done with assistance from Senderra's information technology department in order to enable her to work from home. Senderra says that Loftin may have continued to receive emails sent to her Senderra e-mail address because neither Senderra not Loftin appears to have disabled the forwarding feature at the time of her separation.

During the course of her employment, Naylor also set up an auto-forwarding command, rule or feature on her Senderra e-mail account, which directed all e-mails sent to her Senderra e-mail account to be immediately and contemporaneously forwarded to one or more personal e-mail addresses she owned and/or to which she had access, including her personal email address. Naylor too says that this was done in order to enable her to work from home.

In late August 2015, Senderra says it discovered Naylor's auto forward command and disabled the command through its information technology staff. Senderra later became aware that Loftin had also been forwarding e-mails from her work e-mail to a personal e-mail account. Eventually, Senderra terminated defendants.

III. Legal Standard

The standard of review under Rule 12(c) for judgment on the pleadings is the same as for Rule 12(b)(6). Jelovsek v. Bredesen, 545 F.3d 431, 434 (6th Cir. 2008)(internal citations omitted). A Rule 12(b)(6) motion tests the sufficiency of a plaintiff's pleading. The Rule requires that a complaint "contain something more . . . than . . . a statement of facts that merely creates a suspicion [of] a legally cognizable right of action." Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007)(internal citation omitted). A "plaintiff's obligation to provide the 'grounds' of his 'entitlement to relief' requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Id. "[T]hat a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions. Threadbare recitals of all the elements of a cause of action, supported by mere conclusory statements do not suffice." Ashcroft v. Iqbal, 556 U.S. 662; 129 S. Ct. 1937, 1949 (2009). The court is "not bound to accept as true a legal conclusion couched as a factual allegation."

IV. Analysis

A. Count I - Computer Fraud and Abuse Act

Under the Computer Fraud and Abuse Act ("CFAA"), Senderra must show the Defendants: (1) accessed a protected computer; (2) without authorization or exceeded authorized access; and (3) there was damage or loss to plaintiff of more than $5,000 of value in a one-year period. 18 U.S.C. 1030(a)(2); see also Am. Furukawa, Inc. v. Hossain, 103 F. Supp. 3d 864, 871 (E.D. Mich. 2015).³

Accepting Senderra's allegations as true, defendants contend that the complaint fails to sufficiently plead that defendants alleged email forwarding was done without authorization or exceeding access. There is a circuit split on the meaning of "exceeded authorized access." The split centers on whether the terms "without authorization" under the CFAA should be interpreted broadly or narrowly. Under a broad interpretation, a party accesses a computer "without authorization" if he violates the computer's terms of use, or breaches a duty of loyalty. Ajuba Int'l, L.L.C. v. Saharia, 871 F. Supp. 2d 671, 686 (E.D. Mich. 2012). Under the narrow interpretation, "an employee's misuse or misappropriation of an employer's business information is not 'without authorization' so long as the employer has given the employee permission to access such information." Id.

Courts in this district have adopted the narrow interpretation. See Ajuba Int'l, L.L.C. v. Saharia, 871 F. Supp. 2d 671, 687 (E.D. Mich. 2012) ("Accordingly, a violation for accessing 'without authorization' under the CFAA occurs only where initial access is not permitted and a violation for 'exceeding authorized access' occurs only where initial access is permitted but the access of certain information is not permitted."); Am. Furukawa, Inc. v. Hossain, 103 F. Supp. 3d 864, 873 (E.D. Mich. 2015) ("The Court agrees with the other courts in this district who have adopted the 'narrow' approach to give meaning to the CFAA's 'without authorization' language."). Other district courts in this Circuit have likewise read the statute narrowly. See Dana Ltd. v. Am. Axle & Mfg. Holdings, Inc., No. 1:10-CV-450, 2012 WL 2524008 (W.D. Mich. June 29, 2012);ReMedPar, Inc. v. AllParts Med., L.L.C., 683 F. Supp. 2d 605, 609 (M.D. Tenn. 2010); Black & Decker, Inc. v. Smith, 568 F. Supp. 2d 929 (W.D. Tenn. 2008).

Indeed, the Sixth Circuit has said that if an employee has been granted access to the information, the employee is not "exceeding access" even if the information is misused. See Ajuba Int'l, L.L.C. v. Saharia, 871 F. Supp. 2d 671, 685-86 (E.D. Mich. 2012) (citing LVRC Holdings L.L.C. v. Brekka, 581 F.3d 1127 (9th Cir. 2009); Orbit One Commc'ns, Inc. v. Numerex Corp., 692 F. Supp. 2d 373, 385 (S.D.N.Y. 2010)).

Here, Senderra alleges that throughout defendants' employment, defendants both had authorized access to their email accounts, so any emails sent to defendants during their employment would be within their authorized access. (Doc. 1, Complaint at ¶ 22, 24). In terms of any unauthorized access, Senderra only asserts one of the defendants, Loftin, "may have continued to receive emails" after her termination. Complaint at ¶ 27. Senderra offers no facts supporting the statement that Loftin received any emails after her termination. If Loftin did receive emails to...